JP5453871B2 - Event determination device, event determination program, and event determination method - Google Patents

Description

  The present invention relates to an event discriminating apparatus, an event discriminating program, and an event discriminating method for discriminating whether an event output from a system component device is a normal event or an abnormal event.

  2. Description of the Related Art In recent years, an event monitoring system has been constructed that monitors an event output from a device that constitutes an operating system and notifies a system administrator when an abnormal event occurs.

  The event monitoring system monitors whether an event output from a device constituting the operation system matches a defined failure pattern, and if it matches the pattern, determines that a trouble has occurred and notifies the operator. When monitoring such an event, it is necessary to prepare a failure pattern in advance.

  With reference to FIG. 9, the extraction of the failure pattern of the conventional event monitoring system will be described.

  First, as an advance preparation, classification operations such as an event related to a CPU and an event related to a memory are performed on an event output from a system component device. This classification operation is performed manually by the system developer or mechanically classified based on an event ID attached to the event.

  Next, for each classified event, the system administrator extracts an event that seems to be normal, and registers the extracted event that seems to be normal in the event monitoring apparatus. The event monitoring device has a DB (database) in which events that occurred in the past are registered as past cases, and filters past events in the DB with registered events that appear to be normal Thus, an abnormal event (that is, an abnormal event) is extracted.

  Conversely, it is also possible to extract normal events by extracting events that are considered abnormal by the system administrator and filtering past events with the events that are considered abnormal.

  Further, the following documents are disclosed as related techniques.

JP 2008-41041 A

  In the system to be monitored, a new type of trouble also occurs as the system scale increases. Therefore, there is a case where the system administrator does not know whether the event is a normal event even when viewing the event.

  In addition, it takes time and cost to create an event pattern indicating the occurrence of a trouble, and it is impossible to respond quickly. This leads to a delay in the initial response and causes a delay in system recovery.

  Furthermore, whether it is a normal event or an abnormal event depends on the arbitrary criteria of the person in charge, and the determination of whether it is a normal event or an abnormal event is ambiguous if there is no detailed knowledge of system behavior Become. Moreover, it takes time to select the work.

  The present invention has been made to solve the above-described problems, and it is an object of the present invention to provide an event determination device, an event determination program, and an event determination method that can automatically determine an event using only an event log. To do.

  The event determination device includes an event list creation unit that creates a list of events that occurred within the predetermined period from an event log within a predetermined period, and a log that corresponds to the events in the list created by the event list creation unit. Until all are acquired, the latest date and time within the predetermined period is used as a starting point, the log in the event log is acquired while going back in the past, and the log at the past is more than the log at the time when all the events in the list are acquired And a normal event extracting unit that sets the events in the list as normal events.

  The event determination program creates a list of events that occurred within the predetermined period from event logs within the predetermined period, and until all logs corresponding to the events in the created list are acquired, Starting from the latest date and time, the log in the event log is acquired while going back in the past, and the events in the list corresponding to the past log are more normal than the logs at the time when all the events in the list are acquired. Causes a computer to execute a process set as an event.

  The event determination method creates a list of events that occurred within the predetermined period from event logs within the predetermined period, and acquires all the logs corresponding to the events in the created list until the logs within the predetermined period are acquired. Starting from the latest date and time, the log in the event log is acquired while going back in the past, and the events in the list corresponding to the past log are more normal than the logs at the time when all the events in the list are acquired. The computer executes a process to set as an event.

  Without the system administrator's judgment and other external additional information, it is possible to determine whether the event is a normal event by using only the event log, thereby reducing work time and work cost.

It is a figure which shows the processing range which the event discrimination device of this Embodiment bears in the conventional event monitoring system. It is a figure which shows the characteristic function of the event determination apparatus which concerns on this Embodiment. It is a figure which shows an example of the functional block of the event determination apparatus which concerns on this Embodiment. It is a figure for demonstrating the point of interest of the event determination method which concerns on this Embodiment. It is a figure for demonstrating an example of the content of the event determination method which concerns on this Embodiment. It is a flowchart which shows an example of operation | movement of the event determination apparatus which concerns on this Embodiment. It is a figure which shows an example of the hardware constitutions of the event determination apparatus which concerns on this Embodiment. It is a figure which shows an example of the hardware constitutions inside the event discrimination device which concerns on this Embodiment. It is a figure which shows the example of the conventional event discrimination method.

  FIG. 1 shows the processing range of the event discriminating apparatus according to the present embodiment in a conventional event monitoring system. The event discriminating apparatus according to the present embodiment performs a process surrounded by a broken line in FIG. In other words, the event determination apparatus according to the present embodiment extracts abnormal event patterns that are abnormal events used by the pattern detection function and are notified to the person in charge of operation and the system administrator from event cases that occurred in the past. Process.

  Note that an event means an event that has occurred in a device, and the device in which the event has occurred outputs it as a log to the storage device it owns or to the outside, or notifies it to the outside as a trap. In addition, there is a device having a function of notifying its own state by an external inquiry (polling). The event monitoring system accumulates these log outputs, traps, and polling results in the storage unit together with event occurrence dates and times as past cases. Hereinafter, data in which an event is notified or acquired by the above-described means or some other means is referred to as an event log or simply a log. This event log is data with the date and time when the event occurred.

  Next, a characteristic function of the event determination apparatus according to the present embodiment will be described with reference to FIG. The event discriminating apparatus 100 has a function unit that discriminates between a normal event and an abnormal event with respect to events classified into, for example, an event related to a CPU and an event related to a memory.

  The event determination apparatus 100 can determine whether the event is a normal event or an abnormal event based on only an event log that has occurred in the past, for example, without determination by the system administrator or other additional information from the outside.

  FIG. 3 shows functional blocks of the event determination device 100. The event determination device 100 includes an event range extraction unit 1 (event list creation unit), a normal event extraction unit 2 and an abnormal event extraction unit 3.

  The event range extraction unit 1 creates an event type table 50 that is a list of events that have occurred within the predetermined period from the event log within the predetermined period.

  The normal event extraction unit 2 goes back to the past starting from the latest date and time within the predetermined period until all the logs corresponding to the events in the event type table 50 created by the event range extraction unit 1 are acquired. On the other hand, the log in the event log is acquired, and the event in the event type table 50 corresponding to the log before the time when all the events in the event type table 50 are acquired is set as a normal event.

  The abnormal event extraction unit 3 sets an event in the event type table 50 other than the event set as a normal event by the normal event extraction unit 2 as an abnormal event.

  Next, points of interest of the event determination method according to the present embodiment will be described with reference to FIG. FIG. 4 shows the order of occurrence of events with the horizontal axis as the time axis.

The event discriminating apparatus 100 discriminates between normal and abnormal events from an event log recorded in a mixed state of events output at normal time and abnormal time by paying attention to the following points. to enable.
-Normal events can be output when the system is normal or abnormal.
-An abnormal event is not output when the system is normal. In other words, an abnormal event is output only after a failure occurs in the system.

  If A, B, and C are normal events, and O, P, and Q are abnormal events, according to the example of FIG. 4, when the target device is normal, the abnormal events of O, P, and Q are normal. Only normal events A, B, and C occur without occurring. Here, when a trouble occurs on the target device, O, P, and Q abnormal events and normal events A, B, and C occur thereafter.

  Based on the above points of interest, the event determination method of the present embodiment will be described with reference to FIG. FIG. 5 shows an example in which normal and abnormal events are mixed. As in FIG. 4, A, B, and C are normal events, and O, P, and Q are abnormal events.

  5A, 5C, and 5E show the order of occurrence of events with the horizontal axis as the time axis, as in FIG. 4, and new events become more advanced in the right direction. In this example, the point indicated by the arrow “latest” is the date and time when the contents of the event were examined.

  As described above, when the system is normal, only normal events A, B, and C are recorded in the event log. If a trouble occurs at a certain time, events O, P, and Q at the time of abnormality are recorded in the event log after that date and time.

  FIG. 5A shows an initial state. In the initial state, the entire log is read. In the initial state, it is not yet known which event is a normal event and which event is an abnormal event.

  Next, the event range extraction unit 1 creates an event type table 50 by listing the types of events that have appeared. An event type table 50 created at this time is shown in FIG. The event type table 50 includes, for each event content (event), a flag (appearance) indicating whether the event has appeared in the event log during the determination process, and whether the event is normal or abnormal during the determination process. Each data of a flag (type) indicating whether or not is determined. In the state shown in FIG. 5B, the appearance flag is False and the type flag is Unknown.

The normal event extraction unit 2 performs the following for each event while tracing the log in the past direction starting from the latest time (see FIG. 5C).
For the observed event, change the appearance flag of the corresponding event in the event type table 50 to True.
Determine whether the appearance flag is true for all events in the event type table 50.

  FIG. 5D shows the state of the event type table 50 when processing is performed for events from the latest date and time to the date and time t0 going back in the past. The normal event extraction unit 2 repeats the above process until the appearance flags of all events become True.

  When the occurrence flag of all events becomes true, the normal event extraction unit 2 further changes the type flag of the corresponding event in the event type table 50 for the observed event while further tracing the log in the past direction. (See FIG. 5E). That is, when the appearance flag of all events becomes true, the normal event extraction unit 2 sets the previous event as a normal event.

  The abnormal event extraction unit 3 changes the type flag to abnormal for an event whose type flag remains “Unknown” in the event type table 50 after the processing by the normal event extraction unit 2 is completed.

  FIG. 5F shows the event type table 50 after processing by the normal event extraction unit 2 and the abnormal event extraction unit 3. This completes the discrimination between normal and abnormal for all events.

  Next, the operation of the event determination apparatus 100 will be described with reference to the flowchart of FIG.

  The event range extraction unit 1 creates (initializes) the event type table 50 (S1). The event range extraction unit 1 extracts one log from the event log (S2), and determines whether the end of the log has been reached (S3). If the end of the log has not been reached (S3, N), the event range extraction unit 1 refers to the event type table 50 (S4), and the event for which the extracted event already exists in the event type table 50 If the log extracted here is an event existing in the event type table 50 (S5, Y), the process returns to S2 and is an event existing in the event type table 50. When there is no event (S5, N), the event range extraction unit 1 adds the extracted event as an appearance flag = false and a status flag = Unknown to the event type table 50 (S6). After the addition, the process returns to S2.

  In the process of S3, when it is determined that the end of the log has been reached (S3, Y), the normal event extraction unit 2 extracts the latest log from the event log (S7). The normal event extraction unit 2 determines whether the end of the event log has been reached (S8), and if the end has been reached (S8, Y), the process ends.

  If the end has not been reached (N in S8), the appearance flag is set to true for the corresponding event in the event type table 50 (S9). The normal event extraction unit 2 determines whether the appearance flags of all events are true (S10). If all the appearance flags are not true (S10, N), the process returns to S7 and continues to the next log. Will continue. On the other hand, when all the appearance flags are true (S10, Y), the normal event extraction unit 2 sets the status flag = normal for the event corresponding to the previous log in the event type table 50 ( S11).

  The abnormal event extraction unit 3 sets the state = abnormal for the remaining events (status flag = unusual event) in the event type table 50.

  Note that the existing pattern detection function unit notifies the operation staff and the system administrator when an event whose status flag is set to abnormal is output from the device.

  In the above example, all the logs from the time when the contents of the event log are examined to the end of the log are set as the processing range. However, the event determination apparatus 100 can also perform processing within the arbitrarily designated date and time. That is, the event range extraction unit 1 may set a log as a processing range at least from the time when an event has occurred in the past to an arbitrary date and time.

  The event discriminating apparatus 100 according to the present embodiment performs processing after being classified into an event related to a CPU, an event related to a memory, and the like, but it is naturally applicable even if it is not classified.

  The present invention can be applied to the following computer system. FIG. 7 is a diagram illustrating an example of a computer system to which the present invention is applied. A computer system 900 shown in this figure includes a main body 901 incorporating a CPU, a disk drive, and the like, a display 902 that displays an image according to an instruction from the main body 901, a keyboard 903 for inputting various information to the computer system 900, A mouse 904 for designating an arbitrary position on the display screen 902a of the display 902 and a communication device 905 for accessing an external database or the like and downloading a program or the like stored in another computer system are provided. The communication device 905 may be a network communication card, a modem, or the like.

  A program that executes the above-described steps in the computer system that constitutes the event determination apparatus as described above can be provided as an event determination program. This program can be executed by the computer system of the event discriminating apparatus by storing it in a recording medium readable by the computer system. A program for executing the above steps is stored in a portable recording medium such as a disk 910 or downloaded from a recording medium 906 of another computer system by the communication device 905. In addition, an event determination program that causes the computer system 900 to have at least an event determination function is input to the computer system 900 and compiled. This program causes the computer system 900 to operate as an event determination system having an event determination function. Further, this program may be stored in a computer-readable recording medium such as a disk 910, for example. Here, examples of the recording medium readable by the computer system 900 include an internal storage device such as a ROM and a RAM, a portable storage such as a disk 910, a flexible disk, a DVD disk, a magneto-optical disk, and an IC card. It includes a medium, a database holding a computer program, or other computer systems and the database, and various recording media accessible by a computer system connected via communication means such as a communication device 905.

  Here, the hardware configuration of the event discriminating apparatus will be described with reference to FIG. The event determination device includes a CPU 951 that is an arithmetic processing device, a memory 952 that is a main storage device, a disk 910, and the like, a disk drive 953 that reads and writes data, and a nonvolatile storage device 954 that is a nonvolatile storage device. And an I / O device 955 for controlling data communication with the outside. Note that each function block in the event discriminating apparatus described above includes CPU 951, memory 952, nonvolatile storage device 954, I / O device 955 hardware resources, software stored in the nonvolatile storage device 954 in advance. Is realized through collaboration.

  The present invention can be implemented in various other forms without departing from the spirit or main features thereof. Therefore, the above-described embodiment is merely an example in all respects and should not be interpreted in a limited manner. The scope of the present invention is shown by the scope of claims, and is not restricted by the text of the specification. Moreover, all modifications, various improvements, substitutions and modifications belonging to the equivalent scope of the claims are all within the scope of the present invention.

  1 event range extraction unit, 2 normal event extraction unit, 3 abnormal event extraction unit, 50 event type table, 100 event discrimination device.

Claims (5)

An event list creation unit that creates a list of types of events that occurred within the predetermined period from an event log within the predetermined period;
Until you appear all kinds of events in the list that was created by the event list generation unit, as a starting point the latest date and time within the predetermined period of time, to get the log of the in the event log while dates back to the past, the list A normal event extraction unit that sets the event type in the list as a normal event corresponding to a past log rather than a log at the time when all of the event types appear in the list,
An event determination device comprising: The event discriminating apparatus according to claim 1, further comprising:
An event discriminating apparatus comprising: an abnormal event extraction unit that sets an event type in the list other than the event type set as a normal event by the normal event extraction unit as an abnormal event. In the event discrimination device according to claim 1,
The event list creation unit
Create a list with appearance flags and type flags for each type of event that occurred within a given period,
The normal event extraction unit sets an appearance flag of the corresponding event type in the list as an appearance flag when there is an event type corresponding to the log currently processed in the list, and the list If the event type all occurrences flag of the inner is set in the flag of the appearance effect, the event types in the list currently it is processing than log corresponding to the last log of the event log, type An event discriminating apparatus characterized in that a flag is set to a normal flag. Create a list of event types that occurred within the specified period from the event log within the specified period,
Until you appear all kinds of events in the created list as a starting point the latest date and time within the predetermined period of time, to get the log of the in the event log while dates back to the past,
An event determination program for causing a computer to execute a process of setting an event type in the list as a normal event, which corresponds to a past log rather than a log at the time when all the event types in the list appear . Create a list of event types that occurred within the specified period from the event log within the specified period,
Until you appear all kinds of events in the created list as a starting point the latest date and time within the predetermined period of time, to get the log of the in the event log while dates back to the past,
An event determination method in which a computer executes a process of setting an event type in the list as a normal event, which corresponds to a past log rather than a log at the time when all of the event types in the list appear .

Images